In 2025 an intrusion led Jaguar Land Rover to switch off its global systems, and UK car production stopped for about five weeks. Nobody official has said how the attackers got in. We once printed that we knew.
The vector is the one fact everyone wanted and the one fact nobody has. For a year the answer in circulation, including on this site, was a phone call to the IT helpdesk. It had no source. It arrived by analogy from the spring's retail intrusions, and each retelling dropped a qualifier until a possibility read as a finding.
What the record does hold is enough to place the entry: an IT compromise that halted physical production at national scale. JLR acted well, and its first action was to shut down all global systems. The architecture question is why the safe move was everything at once. BlastWave's reading, which is analysis rather than anything JLR has disclosed, is that separating the systems that gate production from the business estate would have let a smaller line be drawn on the first morning, whichever door was used.
What is not known: How the attackers got in has never been stated by JLR, by any government body, in Parliament or by the Information Commissioner. Who they were is claimed by a Telegram group and disputed by anonymous sources in a newspaper investigation; no official attribution exists. Which systems they reached, and whether any operational technology was among them, is undisclosed. JLR has stated no total cost. The Cyber Monitoring Centre's £1.9bn UK-wide figure is a model that assumed a slower recovery than JLR later reported.
Recommendation
Take the path away from the line The systems that gate production sit in their own compartment, reachable from the business estate only through a controlled gateway, a boundary you can name on day one.
Remove credential-based reach No directory account, administrator credential or remote tool on the business side opens anything on the production side. Access is bound to a verified identity.
Make the business side read one way Planning, finance and dealer systems receive production data one way, so plants keep their own schedules when the office goes dark, and a restart does not wait on it.
Sources: JLR statement, 2 Sep 2025; JLR Q2 FY26 results, 14 Nov 2025; JLR Q3 FY26 results, 5 Feb 2026; Cyber Monitoring Centre statement, 22 Oct 2025; Hansard, Commons, 9 Sep 2025. No advisory issued.. Full list with links.
Soft Spots: The vector is undisclosed; no candidate, SAP NetWeaver included, is the way in. That separating production systems would have let JLR draw a boundary on the first morning is BlastWave's analysis, not a disclosed fact.
The full record
Every claim numbered to its source. Last updated .
An intrusion that led a carmaker to switch off its global systems and stopped UK car production for about five weeks, with the way in still undisclosed. What is verified, what is only reported, and what is still unknown.
Summary
In late August 2025 an intrusion led Jaguar Land Rover to shut down all its global systems, and UK vehicle production stopped for about five weeks before a phased restart from 8 October.1,2 How the attackers got in, and who they were, has never been officially stated. JLR has reported quarterly cyber costs and, in the releases we read, no total.2,6
Timeline of the Jaguar Land Rover cyber incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
The incident begins, in the Cyber Monitoring Centre's dating.1
JLR announces a cyber incident, "with the initial action being to shut down all global systems." It says there is no evidence customer data has been stolen but that retail and production activities have been severely disrupted.2,11
Infosecurity Magazine reports that Scattered Lapsus$ Hunters claimed the attack on Telegram, posted screenshots said to be from JLR's internal IT, and said it was trying to extort the firm.9
The National Cyber Security Centre says it is working with JLR to provide support in relation to an incident.13
Urgent question in the House of Commons. The minister describes helpdesk social engineering in general, then says: "I am not saying that that is what happened in this case."7
JLR says some data has been affected and that it is informing the relevant regulators.4
JLR says its teams are working "alongside cybersecurity specialists, the NCSC and law enforcement" to restart safely.14
The UK government announces UK Export Finance backing for a £1.5 billion commercial loan to support JLR's supply chain, repaid over five years.15
JLR announces a phased restart and a financing scheme to pay qualifying suppliers early.3
Restart begins at the Electric Propulsion Manufacturing Centre and the Battery Assembly Centre in the West Midlands, to be followed that week by vehicle manufacturing in Nitra, Slovakia, and the Range Rover and Range Rover Sport lines at Solihull.2,3
The Cyber Monitoring Centre classifies the incident as a Category 3 systemic event, with a modeled UK financial impact of £1.9 billion.1
JLR's Q2 FY26 results report £238m of exceptional items, reflecting £196m of cyber related costs and £42m of voluntary redundancy costs.2
Production returns to normal levels, as JLR later reports.6
JLR notifies current and former employees and contractors that their data was affected.5
JLR's Q3 FY26 results report £74m of exceptional items, including £64m of costs related to the cyber incident.6
JLR's full-year FY26 results release states no cumulative cyber cost.12
The New York Times, citing anonymous sources, reports Russian actors, says the hackers "exploited vulnerabilities in aging technology," and says the Telegram claimants were not responsible.10
Infosecurity Magazine reports that JLR's group CISO at the time of the incident said no social engineering was involved, and did not confirm attribution.16
BlastWave adds a dated editor's note to its Volume 1 Hackopedia entry withdrawing the helpdesk vishing account it had published as fact.8
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Phased restart from 8 October 2025; normal levels by mid November2,6
Verified
How did the attackers get in?
Not stated by JLR, any government body, Parliament or the Information Commissioner1,7
Undisclosed
Was it a vishing call to the IT helpdesk?
No identifiable source. The minister: "I am not saying that that is what happened in this case"7
Unsourced
Who was behind it?
Claimed by Scattered Lapsus$ Hunters; anonymous sources to the New York Times say Russian actors and that the claimants were not responsible9,10
Contested
Were the plants' control systems reached?
None on the record. CMC: the October restart "may indicate" OT impact is "unlikely to be significant"1
Verified (record only, not proof of none)
Was it ransomware?
JLR has never said. The New York Times's anonymous sources describe "advanced ransomware"10
Reported only
Was a ransom demanded or paid?
Nothing has emerged in the public domain either way, per the CMC1
Undisclosed
JLR's cyber costs
£196m (Q2 FY26) and £64m (Q3 FY26), each within quarterly exceptional items; no stated total in the releases we read2,6,12
Verified (quarterly lines)
Is £1.9bn JLR's cost?
No. It is the CMC's modeled UK-wide loss estimate, range £1.6bn to £2.1bn1
Verified
Did the state lend JLR £1.5bn?
No. It backed a five-year commercial bank loan through UK Export Finance15
Verified
How did the attackers get into Jaguar Land Rover?
Nobody official has said. No JLR statement or results release describes an access vector, and neither does the Commons record.2,6,7 As of late September 2026 we found nothing from the NCSC or the Information Commissioner that does, although JLR said on 10 September 2025 that it was informing the relevant regulators.4,13 Answering an urgent question on 9 September 2025, the minister said:
"I am sorry that there is a limit to what I can say on the specifics because I do not want to prejudice the ongoing investigations."
Six weeks later the Cyber Monitoring Centre, the independent UK body that categorizes cyber events, noted the gap itself:
"For reasons that are currently unclear, fewer technical details about this incident have emerged publicly than is usual in such cases."
Accounts closer to JLR exist, and none is a disclosure. The New York Times, citing anonymous sources, reported on 26 June 2026 that "the hackers exploited vulnerabilities in aging technology, then unleashed advanced ransomware." It names no product.10 Infosecurity Magazine reported that Ashish Shrestha, JLR's group CISO at the time, "said that no social engineering was involved in the attack"; that is the magazine's reported speech from an 18 June 2026 conversation, not a direct quotation or a company statement, and he "did not confirm attribution."16 SAP NetWeaver is the strongest named candidate; it rests on a claimant's remark to a newspaper and one researcher's unverified observation, and is unproven. The accurate entry for the vector is Undisclosed.
Did the Jaguar Land Rover attack start with a phone call to the IT helpdesk?
There is no identifiable source for that account. It was the answer in circulation for a year, including on this site, and it arrived by analogy. The spring 2025 retail intrusions had a properly sourced vector: Marks and Spencer's chairman described that intrusion's entry through social engineering to the Business and Trade Sub-Committee on 8 July 2025.17 It is a different incident. The JLR version borrowed its mechanism.
The minister who answered in the Commons on 9 September 2025 described helpdesk tricks across the sector, and was explicit that he was not describing JLR:
"Some of the techniques used are remarkably old-fashioned, such as ringing up helplines ... The new bit is that sometimes people use AI-generated voices, which are remarkably accurate and can lead to further problems. I am not saying that that is what happened in this case, but some of the patterns are across the whole sector."
The ellipsis omits a clause and a comparison to phone hacking; neither qualifies the closing disclaimer. That last sentence fell off almost every retelling. BlastWave's own trace of the account runs by date: an unsourced vendor blog on 8 September 2025; "it is possible that" in a trade outlet on 17 September; "investigations suggest," with no investigation named, in a content blog on 3 October; and a flat statement on 12 November by an executive with no stated link to the response, reasoning from the retail case.18 No evidence was added along the way. The qualifiers fell off.
Our Volume 1 Hackopedia entry stated the vishing call as fact, and our short video opened on it. We had no source. A dated editor's note on 1 September 2026 withdrew it.8
Were Jaguar Land Rover's factory control systems hacked?
Nothing on the public record says an attacker reached operational technology, and nothing on the record proves the plants were untouched. JLR's first action was "to shut down all global systems."2 The Cyber Monitoring Centre, discussing the possibility of OT damage, wrote that "the fact that production started again in early October may indicate that this is unlikely to be significant."1 Its word is "unlikely," conditioned on "may indicate."
That places the incident as an IT compromise that halted physical production, at national scale: about five weeks of stopped UK lines and, in the CMC's model, more than 5,000 UK organizations affected.1 The lines stopped because the company switched off the systems they depend on. "No public evidence" is a statement about the record, not a finding that the plants were clean.
How much did the Jaguar Land Rover cyber incident cost?
JLR has reported two quarterly lines, not a total. Each carries its own label:
"Exceptional items of £238m in the quarter reflect cyber related costs of £196m and voluntary redundancy programme costs of £42m."
"Exceptional items of £74m in the quarter includes £64m of costs related to the cyber incident."
The two lines sum to £260m. That is our arithmetic, not a total JLR has stated in any release we read, and neither line is "the cost of the attack."2,6,12 Revenue was £4.9bn in Q2, down 24% year on year, and £4.5bn in Q3, down 39%, for reasons that include tariffs as well as the incident.2,6
The £1.9 billion is a different kind of number: the Cyber Monitoring Centre's modeled estimate of UK financial impact, with a range of £1.6bn to £2.1bn, across more than 5,000 UK organizations. It excludes any loss from the apparent data breach and any assumption about ransoms, and it assumed "an early January 2026 return to full production." JLR later reported normal production by mid November; as of late September 2026 we found no revision by the CMC. The CMC's own superlative is hedged: "At £1.9 billion of financial loss, this incident appears to be the most economically damaging cyber event to hit the UK."1,6
What is still not known about Jaguar Land Rover
How the attackers got in. JLR, the government, Parliament and the Information Commissioner have not said, as of late September 2026.7
Who they were. A Telegram group claimed it; anonymous sources in a newspaper investigation dispute that. No official attribution exists.9,10
Which systems the attackers reached, and whether any operational technology was among them.
What malware was used. JLR has never characterized it.
JLR's total cyber cost. It has reported quarterly exceptional lines and stated no total in the releases we read.2,6,12
Whether the CMC has revised its £1.9bn estimate, which assumed a slower recovery than JLR later reported.1,6
Why so little has emerged. The CMC said fewer technical details had emerged than usual "for reasons that are currently unclear." That remains true.1
Claims about Jaguar Land Rover the record does not support
Widely repeated claim
What the record says
"It started with a vishing call to the JLR IT helpdesk."
No identifiable source. Never stated by JLR, the government, Parliament or any regulator. The minister who described helpdesk tricks added: "I am not saying that that is what happened in this case." BlastWave published this as fact and withdrew it on 1 September 2026.7,8
"The most economically damaging cyber event to hit the UK."
The CMC's wording is "appears to be," and the figure behind it is a modeled estimate. A wire copy of the CMC's statement dropped the hedge.1,19
"Russian hackers were behind the JLR attack."
Anonymous sources to the New York Times. No government, law enforcement or JLR attribution; JLR's CISO at the time did not confirm attribution.10,16
"~$258M for JLR"
One quarter's £196m exceptional line, converted at an unstated rate with its label stripped, and the next quarter's £64m missing. JLR has stated no total in the releases we read.2,6,8
"~$2.5B to UK economy"
An unlabeled conversion of the CMC's modeled £1.9bn, not a CMC figure and not JLR's cost.1,8
"The plant was not compromised."
Overstates the record in the other direction. There is no public evidence OT was reached, and the CMC's reading is "unlikely," conditioned on "may indicate."1,18
Including our own. Our Volume 1 Hackopedia entry stated as fact that the intrusion began with a vishing call to the JLR IT helpdesk, and our short video opened on that call. We had no source, and a dated editor's note withdrew it on 1 September 2026. That correction stopped one field short: the same page's cost field still read "~$258M for JLR, ~$2.5B to UK economy," two converted figures with their labels stripped, and the note said the impact figures were not in dispute. The page's "Prevention Failure" field, "Insufficient IT-OT isolation and excessive blast radius," also reads as a finding when it is our inference.8 Our blog of 1 September 2026 dropped the CMC's "appears to be" from its title, said "The plant was not compromised," gave the Q2 £196m without the Q3 £64m, and presented the former CISO's remark, which is a magazine's reported speech, as said on the record.18 All are corrected on this page. We correct our own record first; it is what earns the right to correct anyone else's.
Did the UK government bail out Jaguar Land Rover?
No. It backed a commercial bank loan; the state did not lend the money. On 28 September 2025 the government announced that UK Export Finance would back a five-year commercial loan expected to unlock £1.5 billion to support JLR's supply chain. Under the scheme UKEF covers part of the commercial lenders' risk, typically up to 80%.15 JLR's Q2 release records the loan as secured in October.2
Alongside it, JLR's own scheme of 7 October 2025 gave qualifying suppliers "a majority prepayment shortly after the point of order and a final true-up payment on receipt of invoice."3 The stated purpose of both was the supply chain.
BlastWave analysis: the door never decided the size of the event
Analysis, not a disclosed fact
JLR acted well. It shut down fast, paid qualifying suppliers early to get the restart moving, and reported normal production by mid November.2,3,6 The architecture question is why the safe move was everything at once. Switching off a global estate is what an operator does when it cannot draw a smaller line around what an intruder might reach, and proving each system clean is what turns a day into weeks. That is a general statement about containment, not a disclosed fact about JLR's network.
BlastWave's reading, which is analysis rather than anything JLR has disclosed, is that separating the systems that gate production from the business estate would have let that line be drawn on the first morning, whichever door was used. The door was never the part that decided the size of the event.
Podcast: “The Test Strip” (8:59). Joe Baxter and Cam Cullen on why the expensive part was never the way in but not being able to say, on the first morning, what the intruders could reach.
Video: Jaguar Land Rover Short (60 to 90 seconds).
Frequently asked questions
What happened in the Jaguar Land Rover cyber incident?
JLR announced a cyber incident on 2 September 2025 and, in its own words, its initial action was to shut down all global systems. The Cyber Monitoring Centre dates the incident to late August 2025 and says UK vehicle production was suspended for approximately five weeks. JLR restarted in phases from 8 October 2025 and reported that production was back to normal levels by mid November.
How did hackers get into Jaguar Land Rover?
It has never been officially stated. No JLR statement or results release describes the access vector, and neither does the Commons record of 9 September 2025, where the minister said there was a limit to what he could say. The Cyber Monitoring Centre said in October 2025 that fewer technical details had emerged than is usual. Every candidate in circulation, including SAP NetWeaver, is unconfirmed.
Was the Jaguar Land Rover attack caused by a vishing call to the helpdesk?
There is no identifiable source for that account. It spread by analogy from a 2025 retail intrusion whose vector was properly sourced. The minister who described helpdesk tricks in the Commons on 9 September 2025 said, "I am not saying that that is what happened in this case." BlastWave published the vishing account as fact in Volume 1 and withdrew it on 1 September 2026.
Who was behind the Jaguar Land Rover cyber attack?
It is unconfirmed. Scattered Lapsus$ Hunters claimed the attack on Telegram in September 2025. A New York Times investigation of 26 June 2026, citing anonymous sources, reported Russian actors and said the Telegram claimants were not responsible. No government, law enforcement body or JLR statement has attributed the attack, and JLR's group CISO at the time did not confirm attribution.
How much did the Jaguar Land Rover cyber attack cost?
JLR has stated no total in the releases we read. Its Q2 FY26 results of 14 November 2025 show £196m of cyber related costs within £238m of exceptional items, and its Q3 results of 5 February 2026 show £64m of costs related to the cyber incident. The £1.9 billion figure is the Cyber Monitoring Centre's modeled estimate of UK-wide loss, not JLR's cost.
Were Jaguar Land Rover's factory control systems hacked?
Nothing on the public record says an attacker reached operational technology. The Cyber Monitoring Centre wrote in October 2025 that the restart in early October may indicate any OT impact was unlikely to be significant. That is a reading of the record, not proof the plants were untouched. Production stopped because JLR shut down the IT systems the plants depend on.
Did the UK government bail out Jaguar Land Rover?
No. On 28 September 2025 the government announced that UK Export Finance would back a five-year commercial bank loan expected to unlock £1.5 billion to support JLR's supply chain. UKEF covers part of the lenders' risk, typically up to 80%. The state did not lend the money itself, and the stated purpose was the supply chain.
Primary sources are JLR's own dated statements and results releases, UK government releases, the Commons record and the Cyber Monitoring Centre's published categorization. Press is cited only as evidence of what was said.
ResearcherCyber Monitoring Centre, "Statement on the Jaguar Land Rover Cyber Incident," 22 October 2025 (Category 3 systemic event).
CompanyJLR, "JLR performance impacted in challenging quarter," Q2 FY26 results release, 14 November 2025. media.jlr.com
CompanyJLR, "JLR restarts manufacturing and introduces new financing solution to pay JLR suppliers early," 7 October 2025. media.jaguarlandrover.com
CompanyJLR, statement of 10 September 2025: some data affected; relevant regulators being informed. Also quoted by TechCrunch, 10 September 2025.
CompanyJLR, notice to current and former employees and contractors that their data was affected, December 2025.
CompanyJLR, "JLR Q3 performance impacted by previously indicated challenges," Q3 FY26 results release, 5 February 2026. media.jaguarlandrover.com
GovernmentHansard, House of Commons, 9 September 2025, "Jaguar Land Rover Cyber-attack" (urgent question), contributions of Chris Bryant MP. Text as transcribed by Parallel Parliament. parallelparliament.co.uk
CompanyBlastWave, Hackopedia Volume 1 entry "Jaguar Land Rover," with editor's note dated 1 September 2026. Cited as evidence of what we said. hackopedia.blastwave.com
PressInfosecurity Magazine, report on the Scattered Lapsus$ Hunters claim on Telegram, 4 September 2025. Cited as evidence of what was claimed.
PressThe New York Times, Goldman, Bradley, Volz and Schwirtz, "A $2.5 Billion Whodunit: The Hack That Dented the U.K. Economy," 26 June 2026. Anonymously sourced; cited as evidence of what was reported.
CompanyJLR, statement of 2 September 2025, as republished in market news.
CompanyJLR, Q4 and full year FY26 results release, 14 May 2026. Cited for the absence of a cumulative cyber cost in the release.
GovernmentNational Cyber Security Centre, statement on the incident at JLR, 5 September 2025. ncsc.gov.uk
CompanyJLR, statement of 23 September 2025, as republished by Hargreaves Lansdown market news. hl.co.uk
GovernmentDepartment for Business and Trade, UK Export Finance and HM Treasury, press release on UK Export Finance backing for a £1.5 billion commercial loan to support JLR's supply chain, 28 September 2025. gov.uk
PressInfosecurity Magazine, Beth Maundrill and Phil Muncaster, 29 June 2026, reporting a conversation with Ashish Shrestha on 18 June 2026. Cited as evidence of what was said. infosecurity-magazine.com
GovernmentArchie Norman, chairman of Marks and Spencer, evidence to the Business and Trade Sub-Committee, 8 July 2025. Cited only to show what a sourced vector looks like; it is a different incident.
CompanyBlastWave blog, "Jaguar Land Rover: The Most Expensive Cyberattack in British History, and the Story Everyone Told About It Came From Nowhere," 1 September 2026. Cited as evidence of what we said, including its dated trace of the helpdesk account. blastwave.com
PressPTI, as published by The Tribune, report on the Cyber Monitoring Centre's estimate, 23 October 2025. Cited as evidence of what was said. tribuneindia.com
Cite this page
BlastWave. “Jaguar Land Rover Cyber Incident (2025): What Is Verified.” Hackopedia, Volume 2, FILE 023. Last verified 15 October 2026. https://hackopedia.blastwave.com/manufacturing/jaguar-land-rover-2025/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 023 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Hand-check at source: the Cyber Monitoring Centre statement re-read for the five-week figure, the early January 2026 assumption, the OT and ransom sentences, the "fewer technical details" sentence and the "appears to be" hedge; the New York Times passages checked against a credited republication; the Infosecurity Magazine article confirmed the former CISO's remark is the magazine's reported speech. Corrected the restart sequence to JLR's 7 October wording: the release names the West Midlands, dates only the engine and battery centers to 8 October, and promises further updates, not production, for Halewood. Restored the CMC's "may indicate" to the process impact field.
26 Sep 2026
Full validation: JLR's Q2 and Q3 FY26 releases, the government's 28 September 2025 release and the Commons exchange re-read. Confirmed that our Volume 1 entry's cost field still showed converted, unlabeled figures and that our 1 September 2026 blog carried errors, and listed both for correction.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected the Volume 1 errors: the helpdesk vishing call stated as fact, and a cost field that converted one quarter's line to dollars with its label stripped.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
